SC-900 Practice Test 47 — 15 Questions

Question 1

Your organization is using Microsoft Entra ID. You want to provide a single sign-on (SSO) experience for users accessing multiple SaaS applications. Which feature should you implement?

Accepted Answer

Microsoft Entra ID as an identity provider. Microsoft Entra ID acts as an identity provider (IdP) to enable single sign-on (SSO) for SaaS applications. When configured as the IdP, Entra ID authenticates the user once and issues a security token (e.g., SAML 2.0 assertion or OpenID Connect token) that is accepted by the SaaS application, eliminating the need for repeated logins. This is the core mechanism for federated SSO across multiple cloud applications.

Answer

Microsoft Entra application proxy

Answer

Microsoft Entra myapps portal

Answer

Microsoft Entra Privileged Identity Management

Question 2

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which policy should you configure?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By configuring a Conditional Access policy that requires device compliance, only devices marked as compliant by Intune can access corporate email. This is the correct mechanism because Conditional Access acts as the gatekeeper that enforces the compliance requirement at the authentication and authorization layer.

Answer

Device compliance policy in Microsoft Intune

Answer

Enrollment restrictions in Microsoft Intune

Answer

App protection policy in Microsoft Intune

Question 3

Your company is implementing a new application that requires users to authenticate using Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) for all users accessing this application, but only when they are connecting from an untrusted network. Which conditional access policy should you configure?

Accepted Answer

Grant control: 'Require multifactor authentication' with a condition on 'Locations' set to 'All trusted locations' as exclusion.. It configures a Conditional Access policy that grants access only when MFA is performed, and excludes trusted network locations. This ensures that MFA is enforced only when users connect from untrusted networks, meeting the security team's requirement.

Answer

Session control: 'Use app enforced restrictions' to block access from untrusted networks.

Answer

Assignments: 'Users and groups' including all users, then grant control: 'Require multifactor authentication' without conditions.

Answer

Grant control: 'Require device to be marked as compliant' with a condition on 'Client apps'.

Question 4

Your organization needs to retain all customer communications data for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (D) is the correct solution because it enables organizations to define retention and deletion policies for data, ensuring that customer communications data is retained for the required 7-year regulatory period and then securely disposed of. This solution directly addresses data retention requirements by applying policies at the workload level (e.g., Exchange Online, SharePoint) to manage the lifecycle of content based on specific rules, such as regulatory compliance.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Loss Prevention

Question 5

Your organization uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to create a custom assessment for a new internal policy. What should you do first?

Accepted Answer

Create a custom template with your internal controls. In Microsoft Purview Compliance Manager, assessments are built from templates that define the controls, improvement actions, and scoring parameters. To create a custom assessment for a new internal policy, you must first create a custom template that includes your own controls, because assessments cannot be created from scratch without a template. This template serves as the foundation for the assessment, allowing you to define the specific controls and actions that map to your internal policy.

Answer

Define the score calculation method for the assessment

Answer

Create control actions and assign them to the assessment

Answer

Use an existing Microsoft template and modify the improvement actions

Question 6

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' label to documents that contain salary information. Which type of sensitivity label configuration should you use?

Accepted Answer

Auto-labeling with sensitive information types. Auto-labeling with sensitive information types allows Microsoft Purview to automatically apply a 'Confidential' label to documents containing salary information based on predefined patterns, such as employee salary data. This configuration uses content scanning to detect sensitive data (e.g., via built-in or custom sensitive information types) and applies the label without user intervention, meeting the requirement for automatic classification.

Answer

Manual labeling

Answer

Default labeling for SharePoint libraries

Answer

Mandatory labeling policy

Question 7

Which TWO of the following are capabilities of Microsoft Defender XDR? (Choose two.)

Accepted Answer

Correlate alerts from multiple domains into a single incident. Microsoft Defender XDR correlates alerts from multiple domains—such as endpoint, email, identity, and cloud apps—into a single incident. This cross-domain correlation is a core capability of the XDR (Extended Detection and Response) solution, enabling security teams to see the full attack story in one place.

Answer

Data loss prevention for sensitive information

Answer

Centralized log analytics for custom queries

Answer

Identity governance and access reviews

Question 8

A company uses Microsoft 365. The security team wants to protect users from clicking malicious URLs in email messages. The solution should rewrite all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites. Which Microsoft Defender for Office 365 feature should they enable?

Accepted Answer

Safe Links. Safe Links is the correct feature because it is specifically designed to protect users from malicious URLs in email messages and Office documents. It rewrites all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites, providing time-of-click protection.

Answer

Anti-phishing policies

Answer

Safe Attachments

Answer

Anti-spam policies

Question 9

Your organization uses Microsoft Purview to govern data in Azure Data Lake Storage. You need to create a data classification policy that automatically tags files containing personally identifiable information (PII) such as social security numbers. Which scanning solution should you use?

Accepted Answer

Microsoft Purview Data Map scanning. Microsoft Purview Data Map scanning is the correct solution because it provides automated scanning and classification of data assets across Azure Data Lake Storage and other sources. It uses built-in classifiers to detect sensitive data types like social security numbers and applies the classification labels directly to the files, enabling governance and policy enforcement.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 10

A company wants to protect against ransomware by detecting and blocking malicious files in email attachments. Which Microsoft security solution should be used?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments and Safe Links features that scan email attachments in real-time using detonation chambers and machine learning to detect and block ransomware and other malicious files. This solution is specifically designed to protect Exchange Online and SharePoint Online from threats delivered via email, making it the correct choice for blocking malicious attachments.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 11

Your organization uses Microsoft Entra ID Governance. You need to ensure that access to a critical application is reviewed every 90 days by the application owner. If the review is not completed, access should be revoked automatically. Which feature should you configure?

Accepted Answer

Access reviews. Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group memberships or application assignments, with automatic revocation of access if the review is not completed. By configuring a review every 90 days and setting the 'Auto apply' action to 'Remove access', you ensure that the application owner must certify access or it is automatically revoked.

Answer

Terms of use

Answer

Privileged Identity Management

Answer

Entitlement management

Question 12

Your company uses Microsoft Purview Data Lifecycle Management. You need to ensure that emails in users' mailboxes are retained for 7 years for compliance, but users should be able to delete emails they no longer need before that period. Which configuration achieves this?

Accepted Answer

Apply a retention policy without a preservation lock. A retention policy without a preservation lock (Option D) allows you to define a retention period (7 years) for emails while still permitting users to delete items before that period ends. When a user deletes an email, it is moved to the Recoverable Items folder and retained for the remainder of the 7-year period, after which it is permanently deleted. This meets the compliance requirement without preventing user deletion.

Answer

Configure a Data Loss Prevention policy

Answer

Place a litigation hold on the mailboxes

Answer

Apply a retention label with record locking

Question 13

A compliance administrator creates the above custom sensitive information type for detecting social security numbers (SSNs). What is required for a document to be classified as containing an SSN?

Accepted Answer

The document must contain a pattern matching the SSN regex and at least one keyword. A custom sensitive information type in Microsoft Purview uses a primary element (the SSN regex pattern) and requires at least one supporting element (a keyword) to trigger a match. This ensures that the document is not falsely classified by the regex alone, which could match random number sequences. The compliance administrator configured the type with a minimum count of one keyword as a proximity requirement, so the document must contain both the regex pattern and at least one keyword.

Answer

The document must contain either the SSN regex or a keyword

Answer

The document must contain the SSN regex with high confidence level

Answer

The document must contain a pattern matching the SSN regex and at least two keywords

Question 14

A company wants to grant temporary, time-limited access to a critical Azure resource for an external consultant. Which Microsoft Entra feature should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources, allowing administrators to grant time-bound, temporary access that automatically expires. This aligns directly with the requirement for temporary, time-limited access for an external consultant, as PIM supports activation windows, approval workflows, and audit logging for such scenarios.

Answer

Entra Verified ID

Answer

Identity Protection

Answer

Conditional Access

Question 15

Your organization is deploying Microsoft Entra ID. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without creating new cloud passwords. Which feature should you configure?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct feature because it synchronizes on-premises Active Directory identities to Microsoft Entra ID and enables password hash synchronization or pass-through authentication, allowing users to sign in with their existing on-premises credentials without creating new cloud passwords. This ensures a seamless hybrid identity experience where the same username and password work for both on-premises and cloud resources.

Answer

Microsoft Entra Multifactor Authentication

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management (PIM)